Technical Summary: Analysis of LLM Vulnerability to GPU Soft Errors

Problem Statement

Large Language Models (LLMs) are increasingly deployed in safety-critical domains such as autonomous driving and healthcare, relying heavily on high-performance GPUs for inference. However, as GPU transistor sizes shrink and operating voltages decrease, these devices are becoming increasingly susceptible to transient soft errors (e.g., single-bit flips caused by environmental factors). While prior research has extensively analyzed GPU reliability for general-purpose applications and Convolutional Neural Networks (CNNs) used in vision tasks, there is a significant gap in understanding the resilience of modern, large-scale LLMs. LLMs differ fundamentally from CNNs in architecture (Transformer-based vs. convolutional), computational patterns (involving KV-cache optimizations and operator fusion), and evaluation metrics (e.g., Perplexity, Exact Match vs. simple accuracy). Existing fault injection methods often rely on algorithm-level perturbations (weight corruption) or micro-architecture-level simulation (which is too slow for LLMs), failing to capture the fine-grained, instruction-level behaviors specific to LLM inference on modern GPUs.

Methodology

To address this gap, the authors conducted the first instruction-level fault injection study specifically targeting LLM inference.

• Framework: The study utilizes NVBitFI, an instruction-level fault injection framework that intercepts GPU kernel operations to inject bit-flip errors into specific GPU instructions. This approach balances simulation speed and accuracy, sitting between slow micro-architecture simulation and fast but abstract algorithm-level injection.
• Experimental Setup: Experiments were conducted on an NVIDIA A100 GPU (80 GB) using CUDA 12.2. The study evaluated three representative LLM architectures: GPT-2, Llama3.2, and Qwen3, across two parameter scales for each.
• Datasets and Tasks: A diverse set of benchmark datasets was used to cover various task complexities, including text generation (Lambada, WikiText-2), commonsense reasoning (PIQA, HellaSwag), mathematical reasoning (GSM8K), and summarization (XSum).
• Fault Injection Scale: The study involved approximately 300 GPU hours for initial characterization and 1,750 GPU hours for multi-dimensional analysis, totaling over 24,000 fault injection trials per model in specific scenarios.
• Metrics: The authors analyzed three primary outcomes:
  1. Detected Unrecoverable Errors (DUE): System crashes or hangs.
  2. Silent Data Corruption (SDC): Incorrect outputs without system failure.
  3. Masked Errors: Faults that do not affect the final output.
     They also introduced the Model Vulnerability Factor (MVF) to quantify the likelihood of a fault leading to a user-visible failure.

Key Contributions

The paper makes the following specific contributions:

1. First Instruction-Level Assessment: It is the first work to systematically assess LLM reliability on GPUs using instruction-level fault injection, analyzing abnormal behaviors and identifying their root causes.
2. Quantification of Instruction Vulnerability: The authors quantify the vulnerability factors of key GPU instruction types and derive an efficient method to approximate the overall MVF of an LLM based on these factors.
3. Multi-Perspective Vulnerability Analysis: A comprehensive analysis was performed across five dimensions:
   • Instruction types
   • Task difficulty
   • Bit positions
   • Operator types (e.g., Attention, MLP, LayerNorm)
   • Network layers

Key Results and Findings

1. Abnormal Behavior and Causes

• DUE Dominance: Unlike conventional applications where errors are often masked, LLMs exhibit a high rate of DUEs. Over 90% of DUE events are attributed to illegal memory accesses (e.g., address out-of-bounds, register out-of-bounds) caused by bit flips in address fields.
• SDC Causes: SDCs are primarily caused by numerical errors (large deviations in floating-point values) rather than address errors. A specific example showed a bit flip in a register causing a value to jump from ~0.2 to ~3.4 × 10³⁸, propagating to incorrect outputs.
• Architecture Sensitivity: GPT-2 (using LayerNorm) showed slightly better resilience than Qwen3 (using RMSNorm), suggesting normalization strategies impact fault tolerance.

2. Instruction-Level Vulnerability

• Instruction Types: Integer and address-related instructions (e.g., SHF, LOP3, LEA) are highly vulnerable and primarily lead to DUEs. Conversely, high-frequency floating-point compute instructions (e.g., FADD, HMMA) are relatively robust but account for the majority of SDCs due to their sheer volume.
• Approximation Method: The authors proposed a group-wise imputation and weighted aggregation method to approximate the overall MVF. This method achieved results within 24% of ground-truth measurements (and <7% for the GPT family), offering a practical tool for rapid vulnerability estimation.

3. Task and Architecture Dependencies

• Task Sensitivity: Robustness varies significantly by task. Reasoning tasks (GSM8K) and cloze-style tasks (Lambada) showed higher robustness, while language modeling (WikiText-2) and long-text summarization (XSum) suffered steep accuracy degradation.
• Parameter Scaling: Increasing model size does not universally improve robustness. While larger models sometimes show better fault-free performance, they can degrade faster under fault injection due to more complex computational pathways that amplify error propagation. This effect is task- and architecture-dependent.

4. Bit Position Sensitivity

• Bit 30 Peak: The most significant bit of the exponent (bit 30 in IEEE single-precision) is the most critical for SDCs. Flips here cause cross-order-of-magnitude numerical deviations. Bit 30's SDC rate was found to be up to 95.8× higher than low-order bits.
• DUE Uniformity: In contrast, DUE rates are relatively uniform across bit positions, as they are often triggered by address corruption regardless of the specific bit flipped.

5. Operator and Layer Analysis

• Operator Vulnerability: The lm head (output layer) is consistently the most vulnerable component across all models. LayerNorm is the most robust.
• Layer Distribution: Vulnerability is not uniform across layers. While the overall distribution shape remains similar as models scale, specific "peak" layers (e.g., early layers or specific intermediate layers) exhibit significantly higher error rates in larger models.

Significance and Claims

The paper claims to provide the first direct connection between transient hardware faults and high-level LLM reliability through instruction-level fault injection. The significance of this work lies in:

• New Insights: It reveals that LLM resilience differs substantially from earlier CNN models, driven by unique architectural features like normalization strategies and operator fusion.
• Design Guidance: The findings inform the design of more effective fault tolerance mechanisms. Specifically, the authors suggest that protection strategies should be selective: prioritizing the lm head and high-order bits (especially bit 30) while potentially relaxing protection for LayerNorm and low-order bits to reduce overhead.
• Scalability Warning: The study highlights that simply scaling up parameters is not a panacea for reliability; in fact, it may exacerbate vulnerability in specific layers and tasks, necessitating a joint consideration of task characteristics and fault-tolerance mechanisms.

The authors conclude that their framework and empirical observations provide quantitative, instruction-level evidence essential for assessing and comparing the reliability of LLM inference systems in real-world GPU environments.